SQL Proxying DMZ webserver connection Announcing the arrival of Valued Associate #679: Cesar...
Why isn't everyone flabbergasted about Bran's "gift"?
Israeli soda type drink
What does こした mean?
How do I deal with an erroneously large refund?
What do you call an IPA symbol that lacks a name (e.g. ɲ)?
What was Apollo 13's "Little Jolt" after MECO?
All ASCII characters with a given bit count
Specify the range of GridLines
Processing ADC conversion result: DMA vs Processor Registers
Suing a Police Officer Instead of the Police Department
Did war bonds have better investment alternatives during WWII?
Is there a way to fake a method response using Mock or Stubs?
false 'Security alert' from Google - every login generates mails from 'no-reply@accounts.google.com'
Eigenvalues of the Laplacian of the directed De Bruijn graph
How would it unbalance gameplay to rule that Weapon Master allows for picking a fighting style?
RIP Packet Format
Co-worker works way more than he should
Test if all elements of a Foldable are the same
Are these square matrices always diagonalisable?
When does Bran Stark remember Jamie pushing him?
Why do people think Winterfell crypts is the safest place for women, children & old people?
Why would the Overseers waste their stock of slaves on the Game?
/bin/ls sorts differently than just ls
What is the ongoing value of the Kanban board to the developers as opposed to management
SQL Proxying DMZ webserver connection
Announcing the arrival of Valued Associate #679: Cesar Manara
Planned maintenance scheduled April 23, 2019 at 23:30 UTC (7:30 pm US/Eastern)
Come Celebrate our 10 Year Anniversary!DMZ - LAN and WebserverClient SQL PerformanceTo DMZ or not-DMZ on new web siteHow to Deploy an ASP.NET Web API- and Browser-based Application to a Production EnvironmentIs an IPSEC tunnel limited to the slowest direction of an asynchronous connection?Debating our network structure (DMZ, database, service)Is it a good idea to only allows connections to be established in the LAN->DMZ direction?Route sql server traffic through firewallDebugging random SQL login failure from Web ServerHow to allow a DMZ server trusted remote access to LAN SQL instance?
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty{ height:90px;width:728px;box-sizing:border-box;
}
We've got a product coming in which is requesting us to open up a connection from the web server (WEB) in our DMZ to our production database server (PROD). The production database is literally only PHI, so my team is rather against this idea. Our primary concern is if WEB becomes compromised the attacker would then have direct access to the production DB residing on PROD. We've already got another server (TRUSTED), for outbound requests and VPN-based inbound only, in the DMZ with SQL access to PROD. The best operation idea we've come up with is to have WEB open its DB connection to TRUSTED via an IPSec tunnel, at which point TRUSTED would act as a proxy and forward the SQL requests to PROD and return traffic along the tunnel. The thought is with this topology WEB as a machine could become compromised but the application or its associated traffic would need to be hijacked in order to act maliciously, rather than allowing any traffic on the correct port direct access to PROD.
Are we over-complicating the scenario or is there a flaw in our logic? If neither, how would you go about doing so?
sql-server web-server proxy ipsec dmz
asked 5 mins ago
flippindflippind
1
New contributor
flippind is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
add a comment |
We've got a product coming in which is requesting us to open up a connection from the web server (WEB) in our DMZ to our production database server (PROD). The production database is literally only PHI, so my team is rather against this idea. Our primary concern is if WEB becomes compromised the attacker would then have direct access to the production DB residing on PROD. We've already got another server (TRUSTED), for outbound requests and VPN-based inbound only, in the DMZ with SQL access to PROD. The best operation idea we've come up with is to have WEB open its DB connection to TRUSTED via an IPSec tunnel, at which point TRUSTED would act as a proxy and forward the SQL requests to PROD and return traffic along the tunnel. The thought is with this topology WEB as a machine could become compromised but the application or its associated traffic would need to be hijacked in order to act maliciously, rather than allowing any traffic on the correct port direct access to PROD.
Are we over-complicating the scenario or is there a flaw in our logic? If neither, how would you go about doing so?
sql-server web-server proxy ipsec dmz
asked 5 mins ago
flippindflippind
1
New contributor
flippind is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
add a comment |
We've got a product coming in which is requesting us to open up a connection from the web server (WEB) in our DMZ to our production database server (PROD). The production database is literally only PHI, so my team is rather against this idea. Our primary concern is if WEB becomes compromised the attacker would then have direct access to the production DB residing on PROD. We've already got another server (TRUSTED), for outbound requests and VPN-based inbound only, in the DMZ with SQL access to PROD. The best operation idea we've come up with is to have WEB open its DB connection to TRUSTED via an IPSec tunnel, at which point TRUSTED would act as a proxy and forward the SQL requests to PROD and return traffic along the tunnel. The thought is with this topology WEB as a machine could become compromised but the application or its associated traffic would need to be hijacked in order to act maliciously, rather than allowing any traffic on the correct port direct access to PROD.
Are we over-complicating the scenario or is there a flaw in our logic? If neither, how would you go about doing so?
sql-server web-server proxy ipsec dmz
asked 5 mins ago
flippindflippind
1
New contributor
flippind is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
We've got a product coming in which is requesting us to open up a connection from the web server (WEB) in our DMZ to our production database server (PROD). The production database is literally only PHI, so my team is rather against this idea. Our primary concern is if WEB becomes compromised the attacker would then have direct access to the production DB residing on PROD. We've already got another server (TRUSTED), for outbound requests and VPN-based inbound only, in the DMZ with SQL access to PROD. The best operation idea we've come up with is to have WEB open its DB connection to TRUSTED via an IPSec tunnel, at which point TRUSTED would act as a proxy and forward the SQL requests to PROD and return traffic along the tunnel. The thought is with this topology WEB as a machine could become compromised but the application or its associated traffic would need to be hijacked in order to act maliciously, rather than allowing any traffic on the correct port direct access to PROD.
Are we over-complicating the scenario or is there a flaw in our logic? If neither, how would you go about doing so?
sql-server web-server proxy ipsec dmz
sql-server web-server proxy ipsec dmz
asked 5 mins ago
flippindflippind
1
New contributor
flippind is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
asked 5 mins ago
flippindflippind
1
New contributor
flippind is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
asked 5 mins ago
flippindflippind
1
New contributor
flippind is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
asked 5 mins ago
flippindflippind
1
asked 5 mins ago
flippindflippind
1
1
New contributor
flippind is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
New contributor
flippind is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
flippind is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
add a comment |
add a comment |
0
active
oldest
votes
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "2"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
flippind is a new contributor. Be nice, and check out our Code of Conduct.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f964325%2fsql-proxying-dmz-webserver-connection%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
0
active
oldest
votes
0
active
oldest
votes
active
oldest
votes
active
oldest
votes
flippind is a new contributor. Be nice, and check out our Code of Conduct.
flippind is a new contributor. Be nice, and check out our Code of Conduct.
flippind is a new contributor. Be nice, and check out our Code of Conduct.
flippind is a new contributor. Be nice, and check out our Code of Conduct.
Thanks for contributing an answer to Server Fault!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f964325%2fsql-proxying-dmz-webserver-connection%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
